Privacy policy.

fizzgig labs (sole-trader operation, london, uk) is the data controller for everything described here. for any privacy question, email sidekick@fizzgig.ai. we don't have a designated dpo - fizzgig is a small enough operation that the founder handles all data-subject requests personally.

• raw source code you scan - only byte counts + which input slots were filled. the synthesis envelope persisted in tool_runs contains finding summaries with redacted snippets, never the surrounding code.
• cookies for tracking. our analytics (plausible + vercel analytics) are both cookieless by design - no persistent identifiers in the browser, no cross-site tracking, no consent banner required under uk ico + eprivacy directive guidance.
• third-party advertising network data. we don't run ads.
• children's data. fizzgig is a developer tool; if you're under 16, please don't use it.

fizzgig uses these third parties to operate. each is listed with what it processes and where it stores data. Article 28 sub-processor disclosure.

• supabase (us-east aws) - database for profiles, api_keys, projects, tool_runs. data processing agreement: supabase dpa.
• cloudflare workers (global edge) - runs every tool. workers don't persist your input - they scan + return findings + forward a privacy-safe summary to the audit log.
• vercel (us / global edge) - hosts the marketing site + dashboard. vercel analytics processes anonymised visit data.
• resend (us) - sends transactional emails (magic links, beta approvals). access to your email address only.
• plausible analytics (eu, frankfurt) - cookieless web analytics. no personal data shared.
• anthropic (us) - only for deep_audit (paid tier). your submitted source code + migrations are sent to anthropic's claude api for review. anthropic's api policy states inputs are not used for model training. acceptable use.
• google (gemini api) (us / global) - only for deep_audit (paid tier). your submitted source code + migrations are sent to google's gemini api for the second-agent review. google's api terms state paid gemini api inputs are not used for training.

international transfers are covered by SCCs (Standard Contractual Clauses) where applicable. the eu-us data privacy framework covers us-based sub-processors that participate.

• active accounts: while your account exists.
• tool runs: 12 months rolling, then auto-purged.
• integration tokens: encrypted-at-rest in fizzgig_vault while the integration is active. hard-purged on account deletion, and available for on-demand hard-purge from /dashboard/integrations (“purge token” button) at any time. hard-purge is irreversible; historical snapshots stay for audit but cannot be refreshed against a purged credential.
• deleted accounts: profile + api keys hard-deleted immediately. integration tokens hard-purged from the vault before the cascade. tool_runs anonymised (user_id set to null) and purged within 30 days. invoices (once payments ship) retained for 7 years per uk tax law.
• waitlist signups: until approved or dismissed, then deleted.

under uk gdpr articles 15-22 you have the right to access, rectify, erase, restrict, port, object to, and not be subject to automated decision-making about your personal data. plus the right to withdraw consent (art 7) and to lodge a complaint with the ICO (art 77).

the per-right detail and how to exercise each:

• right to access - see what we hold on you. self-service via dashboard / profile → export your data.
• right to rectification - correct anything wrong. self-service via dashboard / profile.
• right to erasure (right to be forgotten) - delete your account. self-service via dashboard / profile → delete account.
• right to restriction of processing - ask us to pause processing your data while a query is resolved. email sidekick@fizzgig.ai.
• right to data portability - get your data in a machine-readable format. the export above returns JSON.
• right to object to processing based on legitimate interest (analytics, anti-abuse). email sidekick@fizzgig.ai.
• right to withdraw consent where processing is based on consent (e.g. github username display). email sidekick@fizzgig.ai.
• right to lodge a complaint with the uk ico if you think we've mishandled your data. we'd rather you talk to us first - but it's your right to skip us.

we respond to data-subject requests within 30 days as required by uk gdpr article 12.

we use a small set of strictly-necessary cookies for authentication (supabase session cookies, prefixed sb-). these are exempt from the consent requirement under the eprivacy directive because the site doesn't function without them.

we do notuse cookies for analytics - both plausible and vercel analytics are cookieless by design. there is no consent banner because there's nothing to consent to.

we'll update the last updated date at the top and, for any material change, email every active user before it takes effect. policy diff history will live in the repository commit log once we open-source the marketing site.